Struct ListenerTlsConfig 

pub struct ListenerTlsConfig {
    pub cert_file: Option<PathBuf>,
    pub key_file: Option<PathBuf>,
    pub starttls: Option<ListenerStarttlsConfig>,
    pub on_demand: bool,
    pub server_names: Option<Vec<String>>,
}

Per-listener host-side TLS material (cap-req 06). The host terminates TLS and hands the guest a decrypted plaintext stream (the guest does no crypto). With starttls absent this is implicit TLS (handshake at accept — 465/993); with starttls present it is STARTTLS (plaintext dialog, in-band upgrade on the declared trigger — 25/587/143). Either way requires both cert_file and key_file. File-only (never set from the env overlay).

Fields

cert_file: Option<PathBuf>

PEM certificate chain path.

key_file: Option<PathBuf>

PEM private-key path.

starttls: Option<ListenerStarttlsConfig>

Absent ⇒ implicit TLS (handshake at accept). Present ⇒ STARTTLS (plaintext until the declared trigger, then an in-band upgrade). Still requires cert_file + key_file.

on_demand: bool

Opt this listener into on-demand per-SNI issuance (cap-req 03 #4): a client that negotiates TLS with a verified custom-domain SNI terminating here gets a cert issued the same way the public edge does, sharing the one [serve.on_demand_tls] engine (one issuance budget, one cluster certreq single-flight). Requires [serve.on_demand_tls] enabled at the node. The listener’s own cert_file still serves server_names (and an SNI-less handshake). Default false ⇒ the static cert alone (unchanged). This is transport-level only — it carries no notion of what protocol runs over the listener.

Project-scoped (Security review Finding B): a listener is bound to exactly one project (its project), and that project may front many domains (its tenants/sites). On-demand serving here is restricted to SNIs whose owning project is this project — the listener never serves (nor routes to its guest) a cert for another project’s domain, even though all certs share the one engine + cache. Point an on_demand listener only at a guest that is meant to handle that whole project’s domains.

server_names: Option<Vec<String>>

SNI names the listener’s own static cert_file serves directly (an SNI match here wins before on-demand). Absent/empty ⇒ the static cert serves only SNI-less handshakes (via the no-SNI fallback); every presented SNI then goes to on-demand. Only meaningful with on_demand = true.

Trait Implementations

impl Clone for ListenerTlsConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ListenerTlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ListenerTlsConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ListenerTlsConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ListenerTlsConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.